Thread: My host won't fix their Trojan

Abandon them and make backups, then move hosts. There is nothing you can do, as they are the only ones that can really stop this.

Tell your host to set:

enable_dl = On
to
enable_dl = Off

in the php.ini. There's not really any reason to permit that... if you need ioncube or sourceguardian.. just add them globally to the php.ini as well. That should put a stop to the flame.so/flame.php deal...

You can just create a phpinfo and check whether dl is turned on or off. If it is turned on, ask them to turn it off as Aaron as explained.

The host should know that anyway.

But yes, tell them to do the above =)

Find a new host. It doesn't matter if they correct the issue at this point, with responses like that you could definately find a better host that cares about their clients.

What the heck is that? I'd look into a new host since the one you have doesn't seem to prioritize security...

Indeed, this is unfortunate that they won't take responsibility and fix the problem.

As others have said it is a good time to start looking for a new host, this host is being pretty unresponsive which is not a good quality in a webhost.

👁 Quote
Originally Posted by ByteFortressAaron

Tell your host to set:

enable_dl = On
to
enable_dl = Off

in the php.ini. There's not really any reason to permit that....

There are plenty of uses for all of the php functions, all of them very valid. It's not the function's fault that some designer wrote sloppy code that could be abused easily, that's the designer's fault.

Personally, if I signed up for a host that had most of what the users "recommend" to be disabled, disabled, I'd leave, after demanding a refund, because this does not provide "hosting", it provides a limited environment in which very little can get done, in return for a false sense of security.

It's all about the code you use and the security of it, really. Disabling functions isn't an answer or solution, using proper, secured code is .

They seem to have "fixed" the problem (by rebooting the server, I assume, although they won't tell me what they did), but I will switch to DreamHost as soon as I can justify the $7/month. Thanks for backing me up here.

By the way, the name of this crappy host is WoolNet.

Wow, it sounds like listening to a broken record, reading there responses. It is also dissapointing that they seem to net be "investigating" this issue when they say they are.

👁 Quote
Originally Posted by Shii

They seem to have "fixed" the problem (by rebooting the server, I assume, although they won't tell me what they did), but I will switch to DreamHost as soon as I can justify the $7/month. Thanks for backing me up here.

By the way, the name of this crappy host is WoolNet.

There are so many better hosts out there who actually deliver what they advertise on their website. I'd be running away very fast from DreamHost. Just my opinion.

----edited by self----
humor got away from me again...apologies. 👁 BIGgrin

Pertinent update: I cancelled my hosting with WoolNet and switched to Dreamhost around the time this thread was posted, back in May. It is now December 24 and WoolNet has just now gotten back to me to let me know that they successfully cancelled my hosting. Luckily, I was on the cheapass plan so I wasn't bilked for too much, but this would probably be hell on anyone else who tries to cancel.

Warning to everyone: AVOID WOOLNET.

The cancellation was resolved outside of WHMAutopilot long before you have recieved the e-mail. The e-mail you have gotten is from WHMAutopilot when we clicked 'process' to removed your account from WHMAutopilot (our billing system).

👁 Quote
Originally Posted by linux-tech

There are plenty of uses for all of the php functions, all of them very valid. It's not the function's fault that some designer wrote sloppy code that could be abused easily, that's the designer's fault.

Personally, if I signed up for a host that had most of what the users "recommend" to be disabled, disabled, I'd leave, after demanding a refund, because this does not provide "hosting", it provides a limited environment in which very little can get done, in return for a false sense of security.

It's all about the code you use and the security of it, really. Disabling functions isn't an answer or solution, using proper, secured code is .

While I appreciate the sentiments of your rant, you are aware of what the flame.so/flame.php 'exploit' is, aren't you? You are aware that it does not (other than perhaps how it is uploaded to the machine...in our case though, it was uploaded via ftp.) exploit any code written by anyone? It merely exploits the fact that the dl() function is enabled.

I'm not saying that the user in question is actually experiencing the flame.so/flame.php 'exploit' or any of it's derivatives, but if he/she is, the only solution is to disable dl(). That may be an inconvenience, but it is not an insurmountable one.

We were lucky enough to be 0day on the wonderful flame.so thing back in early 2005. For that reason and for the forehead skin that was left on my desk from banging my head on it during the problem, I do take a personal interest in it. 👁 Smilie

👁 Quote
Originally Posted by macdonaldp 👁 View Post

There are so many better hosts out there who actually deliver what they advertise on their website. I'd be running away very fast from DreamHost. Just my opinion.

hi
we have had a problem with trojans on our websites, at dreamhost, who claim that their policy will not allow them to deal with it. they have suggested that we reinstall all our wordpress sites, and our main site of 2500 dynamic pages.
surely it is easier for a host to scan their servers, find the problem and deal with it, than for us to manually look at every file?
is it bast practise for hosts to deal with trojans, or to insist that clients sort it themselves.

we are very unhappy with dreamhosts response to this. any suggestions of better (and perhaps renewably powered) hosts?

thanks

👁 Quote
Originally Posted by abelhas 👁 View Post

hi
we have had a problem with trojans on our websites, at dreamhost, who claim that their policy will not allow them to deal with it. they have suggested that we reinstall all our wordpress sites, and our main site of 2500 dynamic pages.
surely it is easier for a host to scan their servers, find the problem and deal with it, than for us to manually look at every file?
is it bast practise for hosts to deal with trojans, or to insist that clients sort it themselves.

we are very unhappy with dreamhosts response to this. any suggestions of better (and perhaps renewably powered) hosts?

thanks

I can understand the hosts stance of 'hands off'. In this case, you could download all your site files and run a scan on those locally. You wouldn't have to go through each file individually, and it'll report which files are infected, and where they are. You could then take care of them on the server.

On the other hand, I'm surprised DreamHost wouldn't be proactive in eliminating any viral threat. That doesn't make sense to me. I mean, you pay for their company to exist. If they treat you (and everyone else) poorly and you go somewhere else, they won't have a company for very long.

Durak.